CEH Practice Question: Malware, Social Engineering and Network Attacks
A penetration tester wants to perform a stealth scan without completing the TCP three-way handshake. The target is a web server on port 80. The tester uses Nmap with the -sS flag. What is the expected behavior if the port is open?
⚠ Common exam trap
Candidates often confuse the SYN scan with a full connect scan (-sT) and think an ACK is sent to complete the handshake, or they may mistakenly believe that receiving an RST indicates an open port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The tester receives a SYN/ACK and sends an RST to tear down the connection.
The -sS flag in Nmap performs a SYN stealth scan, which sends a SYN packet to the target port. If the port is open, the target responds with a SYN/ACK, and the tester's operating system kernel automatically sends an RST to tear down the connection before the three-way handshake completes. This avoids establishing a full TCP connection, making the scan less detectable by some intrusion detection systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The tester receives a SYN/ACK and sends an RST to tear down the connection.
Why this is correct
A SYN scan, often referred to as a half-open scan, initiates a TCP handshake by sending a SYN packet to the target port. If the port is open, the target responds with a SYN/ACK packet. To avoid logging a full connection on the target system and thus maintain stealth, the penetration tester immediately sends an RST (reset) packet, tearing down the nascent connection before the three-way handshake completes. This allows port status determination without fully establishing a session.
- ✗
The tester receives an RST, indicating the port is closed.
Why it's wrong here
When a penetration tester sends a SYN packet to a target port that is closed, the target system's TCP/IP stack responds with an RST (reset) packet. This RST packet explicitly indicates that the port is not listening for connections and immediately terminates any attempt to establish a session. Therefore, receiving an RST signifies a closed port, which is not the expected response when attempting to identify an *open* port using a stealthy SYN scan.
- ✗
The tester receives no response, indicating a filtered port.
Why it's wrong here
If a penetration tester sends a SYN packet to a target port and receives no response whatsoever, it typically indicates that the port is filtered. This usually means an intervening firewall or intrusion prevention system (IPS) has intercepted and silently dropped the SYN packet, preventing it from reaching the target host. Consequently, the scanner cannot determine the port's true state (open or closed) because the packet was blocked, making it a filtered port.
- ✗
The tester receives a SYN/ACK and sends an ACK to establish the connection.
Why it's wrong here
If, after receiving a SYN/ACK from the target, the penetration tester proceeds to send an ACK packet, this action completes the standard three-way TCP handshake. While this confirms the port is open, establishing a full connection is not considered stealthy because it typically leaves a complete connection record in the target system's logs. This full handshake is characteristic of a standard TCP connect scan, which is easily detectable and less desirable for covert operations.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.